---
title: "Register a SCITT Signed Statement and get its COSE Receipt"
method: POST
path: "/api/v2/evidence/statement"
tags: ["Evidence"]
---

# Register a SCITT Signed Statement and get its COSE Receipt

`POST /api/v2/evidence/statement`

## Request

- Base URL: `https://api.riskrouter.eu`
- URL: `https://api.riskrouter.eu/api/v2/evidence/statement`
- Auth: HTTP bearer

IETF SCITT registration under the riskrouter-scitt-profile|1 policy: a COSE_Sign1 hash envelope (protected 258 = -16, 32-byte payload), ES256, kid = the id of a key registered with POST /api/v2/evidence/keys, CWT claims iss and sub. The log keeps one leaf holding SHA-256 of the statement with its unprotected header emptied. Returns an RFC 9942 COSE Receipt and the Transparent Statement, base64.

## Response `201`

Registered.

- object
  - `recorded` boolean
  - `statement_digest` string
  - `receipt` string, nullable: base64 COSE Receipt
  - `transparent_statement` string: base64

## Other responses

- `400`: INVALID_STATEMENT or INVALID_STATEMENT_SIGNATURE. Nothing was recorded.
- `401`: No key, or a key that does not resolve.

---

[API](https://skmtc.dev/riskrouter/apis/riskrouter-api.md) · [All operations](https://skmtc.dev/riskrouter/apis/riskrouter-api/llms.txt) · [OpenAPI document](https://skmtc.dev/riskrouter/apis/riskrouter-api/revisions/5fee45dc6d1f?raw)